So I flashed (openwrt-23.05.4-mediatek-filogic-xiaomi_mi-router-ax3000t-squashfs-sysupgrade.bin) in the firmware upgrade (192.168.1.1) and now the router starts up, the orange light is on for 10 seconds, then there’s nothing for 2 seconds, then again orange for 10 seconds. If I turn it off, press reset, and plug in the power, the router lights up orange, then after 2 seconds it lights up blue, but now I can't access either the firmware upgrade or the WebUI. What should I do? Is UART the only option left?
What bootloader you flashed ?
Try to TFTP recovery?
Better to check the serial log.
My journey to flash a completely bricked bootloader:
- Grab a raspi, connect uart to the pins in the router through the bottom of the case. Use raspi-config to enable serial port.
- "curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh " if you dont have rust installed, apt version will fail
- "git clone https://github.com/981213/mtk_uartboot" to grab the flasher
- cd into mtk_uartboot, enter "cargo build", be amazed how long that few lines of code will take to compile...
- cd into target/debug. Download snapshot build of AX3000t, place ...bl31-uboot.fip & ...preloader.bin into this directory
Now the magic fails, does anybody know why?
- ./mtk_uartboot -s /dev/serial0 --aarch64 -p openwrt-mediatek-filogic-xiaomi_mi-router-ax3000t-ubootmod-preloader.bin -f openwrt-mediatek-filogic-xiaomi_mi-router-ax3000t-ubootmod-bl31-uboot.fip
mtk_uartboot - 0.1.1
Using serial port: /dev/serial0
Handshake...
hw code: 0x7981
hw sub code: 0x8a00
hw ver: 0xca00
sw ver: 0x1
Baud rate set to 460800
sending payload to 0x201000...
Checksum: 0xdfe2
Setting baudrate back to 115200
Jumping to 0x201000 in aarch64...
Waiting for BL2. Message below:
==================================
==================================
Timeout waiting for specified message.
Ok, so the fallback method. Grab bl2-mt7981-bga-ddr3-ram.bin from https://github.com/981213/tf-a-mtk/releases
Now enter:
./mtk_uartboot -s /dev/serial0 --aarch64 -p bl2-mt7981-bga-ddr3-ram.bin -f openwrt-mediatek-filogic-xiaomi_mi-router-ax3000t-ubootmod-bl31-uboot.fip
mtk_uartboot - 0.1.1
Using serial port: /dev/serial0
Handshake...
hw code: 0x7981
hw sub code: 0x8a00
hw ver: 0xca00
sw ver: 0x1
Baud rate set to 460800
sending payload to 0x201000...
Checksum: 0x8f29
Setting baudrate back to 115200
Jumping to 0x201000 in aarch64...
Waiting for BL2. Message below:
==================================
NOTICE: BL2: v2.10.0 (release):v2.10.0-mtk
NOTICE: BL2: Built : 13:17:06, Mar 1 2024
NOTICE: WDT: Cold boot
NOTICE: WDT: disabled
NOTICE: EMI: Using DDR3 settings
NOTICE: EMI: Detected DRAM size: 256MB
NOTICE: EMI: complex R/W mem test passed
NOTICE: CPU: MT7981 (1300MHz)
NOTICE: Starting UART download handshake ...
==================================
BL2 UART DL version: 0x10
Baudrate set to: 921600
FIP sent.
==================================
NOTICE: Received FIP 0xbc351 @ 0x40400000 ...
==================================
yeyy, router is back to life 
(at least if you had a bootable system there in the first place and just shot down your bootloader). If not i think now you will be in uboot menu over uart and can flash an image.
Now proceed to flash the correct bootloader like in the howto (snapshot one for winbond flash!!)
Mabe someone can put this into the wiki?
1 Like
I have bootloader from: https://github.com/hanwckf/bl-mt798x
I tried using TFTP, but I couldn't enable the recovery mode (rapid flashing of the orange LED).
I cannot help on this.
I had the same problem. Some new versions of the 3000T seems to have something different internally, and it doesnt accept any SSH Password yet known.
I fixed it by running the XMiR-Patcher (linked in the first post here). It works but has a few flaws - You cannot do a full backup of the original 3000T because it times out - the internal CPU is just not capable of running the command before it gives up. The solution for me was to manually change the phyton code and set a large timeout, then I could do everything without fear of something timing out during the process and softbricking the router.
The problem is something else, since on the almost identical hardware router AX3200 (AX6S) it does this without problems, but on this one, even when you select saving one section at a time in the additional menu, it also gives an error when creating a backup of the ubi section.
xmir patcher never worked for me. A few months ago I successfully installed OpenWRT manually using this device's page on the openwrt site but the tutorial on the page updated and this new method doesn't work for me. I went back to stock firmware because I thought I was having coverage problems but some apps and websites just flat out refuse to work on stock firmware so I want to go back to openwrt
Has anyone tried to use AdGuardHome installed inside the AX3000T and reviewed whether it was draining any resources?
Can you elaborate? No matter what I try with xmir patcher it will just make the router enter some weird state where the wifi networks disappear and I have to reset it with the button behind the router. Did you do the process while connected with a cable or wifi? What python file did you change and how? I really wish I had access to the openwrt page before they changed it recently because I did the process manually with no issues but the page now isn't very clear about the process nor was this forum's first post and you're just left to take guesses and risk bricking the device
Why do you flash a non-openwrt bootloader? Take the SNAPSHOT or connect uart to find out whats the problem of the bootloader
You can use xmir patcher to set the root ssh password
I dont know what was the problem. I just gave the script more time before timing out and it worked. Manually running the commands via SSH was quite slow, so it made sense. This is being tracked in a Issue (github of the script), but with no official answer.
I'm struggling to find out how to do this. Does anyone have further information on the steps required?
Just want to add my experience. I did manage to install openwrt (uboot layout) and am using it with ax and 160Mhz width.
Ordered a chinese AX3000T from aliexpress, google translated the instuctions, enabled ssh using xmir patcher and followed to wiki to install OpenWRT and later ubootmod.
Not sure if I messed something up because it seemingly did brick when trying to go ubootmod (using the 23.05.3), thought it was truly dead, no led and no lifesign, but I could eventually tftp recover and install a snapshot which did work...
I use it as one out of many APs with fast roaming enabled, maybe there was some issue with WED - I think I observed network issues with it on and doing fast roaming, but having WED off works just fine...
1 Like
There are instructions a few posts below the comment you replied to, look for the guide from alexq
1 Like
Thanks, but is it supposed that you can see the chip without opening the case? I can not see anything. no winbond and no other flash. It there is no flash chip means that i haven't winbond? or do I must find one chip in this position?
Thanks
I know its had to see unless you know what you are looking for. Go in a dark place, shine your torch through the holes beneath it and look closely, its the only chip in this region.
When you spot it you will see the logo, they are easy to separate
2 Likes
Ok, now I see it, i must try now to read the logo, very dificult with shadows.
How you got images/links of the winbond and the other flash chip logo?
Ok, I have managed to. First of all it is better to turn on router 90 degress and put the light oritented from up to down.
I have read in my flash chip: ESMT, so it is not winbond, thanks a lot for your help.